CVE-2025-4365: Arbitrary file read in NetScaler Console and NetScaler SDX (SVM)

PriorityP351high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EPSS

7.46%

93.7th percentile

Arbitrary file read in NetScaler Console and NetScaler SDX (SVM)

Affected

15 ranges

Vendor	Product	Version range	Fixed in
citrix	citrix_adm	—	—
citrix	citrix_hypervisor	—	—
citrix	citrix_virtual_apps_and_desktops	—	—
citrix	endpoint_management	—	—
citrix	netscaler_adc	—	—
citrix	netscaler_console	—	—
citrix	netscaler_console	—	—
citrix	netscaler_gateway	—	—
citrix	netscaler_sdx	>= 13.1-49.13 < 13.1-58.32	13.1-58.32
citrix	netscaler_sdx	>= 14.1-4.42 < 14.1-47.46	14.1-47.46
citrix	xenserver	—	—
netscaler	console	>= 13.1 < 58.32	58.32
netscaler	console	>= 14.1 < 47.46	47.46
netscaler	sdx	>= 13.1 < 58.32	58.32
netscaler	sdx	>= 14.1 < 47.46	47.46

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvdv4.06.9MEDIUMCVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

Suricata

ET WEB_SPECIFIC_APPS Citrix NetScaler Console Authenticated Arbitrary File Read (CVE-2025-4365)

suricata·2026-01-30·CVSS 6.9

CVE-2025-4365 [MEDIUM] ET WEB_SPECIFIC_APPS Citrix NetScaler Console Authenticated Arbitrary File Read (CVE-2025-4365) ET WEB_SPECIFIC_APPS Citrix NetScaler Console Authenticated Arbitrary File Read (CVE-2025-4365) Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Citrix NetScaler Console Authenticated Arbitrary File Read (CVE-2025-4365)"; flow:established,to_server; http.uri; content:"/nitro/v1/download"; fast_pattern; http.header; to_lowercase; content:"file|3a 20|"; content:"authorization|3a 20|"; http.method; content:"GET"; reference:url,www.rapid7.com/blog/post/cve-2025-4365-cve-unassigned-netscaler-console-sdx-authenticated-arbitrary-file-read-write-fixed/; reference:cve,2025-4365; classtype:web-application-attack; sid:2067198; rev:1; metadata:affected_product Netscaler, attack_target Server, tls_state TLSDecrypt, created_at 2026_01_30, cve CVE_2025_4365, deployment Perimeter, dep

Suricata

ET WEB_SPECIFIC_APPS Citrix Netscaler Console Authenticated Arbitrary File Write (CVE-2024-12284)

suricata·2026-01-30·CVSS 8.8

CVE-2024-12284 [HIGH] ET WEB_SPECIFIC_APPS Citrix Netscaler Console Authenticated Arbitrary File Write (CVE-2024-12284) ET WEB_SPECIFIC_APPS Citrix Netscaler Console Authenticated Arbitrary File Write (CVE-2024-12284) Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Citrix Netscaler Console Authenticated Arbitrary File Write (CVE-2024-12284)"; flow:established,to_server; http.uri; content:"/stylebook/nitro/v2/config/stylebooks/actions/import"; fast_pattern; http.request_body; content:"|22|import|22 3a|"; content:"|22|file_name|22 3a|"; pcre:"/^\s*\x22[^\x22]*?\x2e(?:zip|jar|tar|gz|tgz|bz2)/R"; content:"|22|base64|22|"; http.method; content:"POST"; reference:url,www.rapid7.com/blog/post/cve-2025-4365-cve-unassigned-netscaler-console-sdx-authenticated-arbitrary-file-read-write-fixed/; reference:cve,2024-12284; classtype:web-application-attack; sid:2067197; rev:1; metadata:affected_product